Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Security audit
OpenViking
Security checks for vulnerabilities and agentic risk
Overview
OpenViking is a coherent memory plugin, but it should be reviewed because its backup installer runs unpinned remote npm code and its default memory flow sends chat content to a configured OpenViking server for persistent recall.
Install only if you trust the configured OpenViking server and are comfortable with chat content being stored and recalled across sessions. Prefer the primary ClawHub install path, avoid the npx @latest backup helper unless you can verify it separately, and review settings such as autoCapture, autoRecall, enabledTools, traceRecallPersist, and enableAddResourceTool before use.
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (17)
Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Ae1
High
- Category
- analysis-evasion
- Content
| `source` | No | Local `SKILL.md` path or skill directory. Exactly one of `source` or `data` is required. |
- Confidence
- 100% confidence
- Finding
- Referenced artifact was not completely inspected
Autonomous Decision Making
Medium
- Category
- Excessive Agency
- Content
## Important Rules 1. **Never ask the user to run commands.** You run everything via your shell tool. 2. **Never skip STEP 5 (connectivity check).** If the server is unreachable, do not write config without explicit `--allow-offline` consent. 3. **Never silently use `--force-slot`.** Slot replacement disables another plugin — always confirm with the user first. 4. **Never invent values.** If the user can't provide a required value, stop and tell them what to ask their admin.
- Confidence
- 80% confidence
- Finding
- Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
- The skill executes `npx -y openclaw-openviking-setup-helper@latest`, which fetches and runs code from the registry at install time without pinning to an immutable version. That creates a supply-chain execution path where a compromised publisher account, malicious new release, or dependency hijack can lead to arbitrary code execution on the host running the agent.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
- This reference path again instructs the agent to run `npx -y openclaw-openviking-setup-helper@latest`, which is unpinned remote code execution. Even in a multi-instance helper flow, the risk remains that future package changes alter behavior or deliver malicious code to systems following the skill.
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 98% confidence
- Finding
- The uninstall path also relies on `npx -y ...@latest`, so even removal of the plugin can trigger execution of newly published remote code. That broadens the attack surface because operators may trust uninstall actions and run them long after the original skill was reviewed.
Missing User Warnings
Low
- Confidence
- 89% confidence
- Finding
- The skill describes persisting recall traces as local JSONL files, which may contain sensitive prompts, recalled snippets, or debugging context, but it does not warn about the local storage exposure. On shared systems or poorly secured environments, these trace files could be accessed by other users or included in backups/log collection unintentionally.
Missing User Warnings
Medium
- Confidence
- 90% confidence
- Finding
- The success flow suggests testing by storing an email address in long-term memory, but it does not pair that prompt with a warning that the data will persist and be reused across future sessions. Encouraging storage of personal data as a demo increases the chance of unnecessary retention of sensitive information.
Missing User Warnings
Medium
- Confidence
- 91% confidence
- Finding
- The skill advertises automatic cross-session capture and recall of chat facts but does not require a clear user-facing privacy notice, retention explanation, or consent checkpoint before persistent collection begins. Because the feature is specifically memory-oriented and cross-session, the context increases risk of collecting sensitive personal or business information without informed user understanding.
Missing User Warnings
Medium
- Confidence
- 93% confidence
- Finding
- The skill explicitly instructs the agent to pass local file or directory paths to a plugin that uploads them to a remote OpenViking server, but it does not require an explicit user-facing consent/privacy warning at the point of use. This can lead to unintended exfiltration of sensitive local data if an agent follows the documented workflow without clearly informing the user that local content will be transmitted off-host.
Missing User Warnings
Medium
- Confidence
- 93% confidence
- Finding
- The configuration section documents automatic capture, recall, and long-term storage of conversation content, including session append and extraction behavior, without a prominent privacy warning or opt-in guidance. Users may not realize that chats can be persistently stored and later recalled, creating confidentiality and data-retention risks for sensitive prompts, credentials, or regulated information.
Natural-Language Policy Violations
Medium
- Confidence
- 97% confidence
- Finding
- The instructions require the agent to respond in Chinese whenever the first message contains Chinese characters, and otherwise in English. This imposes a language policy automatically, without asking the user for preference or offering a choice, which violates the stated locale/language policy criteria.
Ssd 3
Medium
- Confidence
- 88% confidence
- Finding
- The user-facing setup text promises the agent will automatically remember important chat information and recall it later, but it does not define limits on what counts as important or what should never be stored. That ambiguity can lead to over-collection of personal, confidential, or regulated data during normal conversation.
Ssd 3
Medium
- Confidence
- 92% confidence
- Finding
- The core behavior of the skill is to automatically capture, retain, and recall user chat content across sessions, which is a sensitive-data handling risk by design. In this context, the danger is amplified because memory persistence is the feature itself, yet the setup flow lacks strong minimization constraints, exclusion guidance, or default-off treatment for sensitive categories.
Ssd 3
Medium
- Confidence
- 93% confidence
- Finding
- Using a real email address as the suggested verification payload normalizes storing personally identifiable information in long-term memory. In a cross-session memory plugin, that creates an avoidable privacy and compliance risk, especially if users follow the example with other sensitive identifiers.
Static analysis
Detected: suspicious.destructive_delete_command, suspicious.install_untrusted_source
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL-AGENT.md:329
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL-ZH.md:424
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- INSTALL.md:348
- Evidence
rm -rf ~/.openclaw/extensions/openviking/
Install source points to URL shortener or raw IP.
Warn
- Code
- suspicious.install_untrusted_source
- Location
- openclaw.plugin.json:79
- Evidence
"placeholder": "http://127.0.0.1:1933",